Use of Externally-Controlled Input to Select Classes or Code in Infinispan
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-10174US | high8.8 | — | ||
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any cla… | ||||
02
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2020:0481WEB
- https://access.redhat.com/errata/RHSA-2020:0727WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10174WEB
- https://github.com/infinispan/infinispanPACKAGE
- https://github.com/infinispan/infinispan/commit/5dbb05cfaca01a1a66732b82a0f5ba615ccbd214WEB
- https://github.com/infinispan/infinispan/commit/7bdc2822ccf79127a488130239c49a5e944e3ca2WEB
- https://nvd.nist.gov/vuln/detail/CVE-2019-10174ADVISORY
- https://security.netapp.com/advisory/ntap-20220210-0018WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan